From patchwork Fri Oct 26 23:24:02 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Rasmus Villemoes X-Patchwork-Id: 10657979 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id EC99F13A9 for ; Fri, 26 Oct 2018 23:24:15 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id D561A2CC3A for ; Fri, 26 Oct 2018 23:24:15 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id C9B622CC78; Fri, 26 Oct 2018 23:24:15 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-8.0 required=2.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,MAILING_LIST_MULTI,RCVD_IN_DNSWL_HI autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 677502CC4A for ; Fri, 26 Oct 2018 23:24:15 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1728857AbeJ0IDN (ORCPT ); Sat, 27 Oct 2018 04:03:13 -0400 Received: from mail-ed1-f68.google.com ([209.85.208.68]:34528 "EHLO mail-ed1-f68.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1727514AbeJ0IDN (ORCPT ); Sat, 27 Oct 2018 04:03:13 -0400 Received: by mail-ed1-f68.google.com with SMTP id w19-v6so2652858eds.1 for ; Fri, 26 Oct 2018 16:24:13 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rasmusvillemoes.dk; s=google; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=JEBobtHg1qgbOc630FYStYv8aN4/HB7o15k1W7ldVoc=; b=OYLVgtooq7ObuotGpIxgk8rxockKE76sRnIUI5hhbNEPQr5sYwOuDQ6Z8jJ1Y8Wukq LlOfv5pwxHVPPX8UWCN9yb417DGJ1PuPKzpY5wN8mTRM1jnj3Mnzuhx20ppRJ1jsUvQs H8Mez81Q0oVN6ipJU9vEY3h/PnfEABbRlQtNw= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=JEBobtHg1qgbOc630FYStYv8aN4/HB7o15k1W7ldVoc=; b=YuWzXkNK5dzVl0I6aak9Sql/7dd9NyXwR//W0C8yUQl+Cqs5vBM9t9Sft+cJyxxDtN FRa1quj2CygduFqXL9PmR+n/pzf+PInNPz/7nBBY8qBfqidYPQ6kyiJja0KDM6Fkx1pM coOHFPUPqmXHCXegxpm2+Q8oK4cZOs4rbQQ70LHl0hQkFAoGtsh1lKRiaRl2AKxLV8iB UfAKMFKd6c4jOqf/lBUSrxAD4BRpDw6i+RpeDgqgXCOPijuHyH7sqPm6/gGBCzJFWKP8 urNzFc4L8dsF4p36UXCmC184v7m1cY4BhaiwJTm92QUTl3Ya1Ugglih2SNUGgTRPWu9j OVMg== X-Gm-Message-State: AGRZ1gK6MZsLALZAuNh0jODtiaQM/DYe0Wm46MpXn1gBEK1Zg/KpX7dP TwtaEmgm5I88PsjQb2hENPZCoFXiKjj1Zg== X-Google-Smtp-Source: AJdET5en4qW4GcEmqKcIU6ys6vzhrxNJTPyQnLSiny8uDtCWsXC+TwfPcq7Q5NH36j9AAG+hsSQXMw== X-Received: by 2002:a17:906:2111:: with SMTP id 17-v6mr3604087ejt.206.1540596252659; Fri, 26 Oct 2018 16:24:12 -0700 (PDT) Received: from prevas-ravi.waoo.dk (dhcp-5-186-114-252.cgn.ip.fibianet.dk. [5.186.114.252]) by smtp.gmail.com with ESMTPSA id o13-v6sm3986746edc.95.2018.10.26.16.24.10 (version=TLS1_2 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Fri, 26 Oct 2018 16:24:11 -0700 (PDT) From: Rasmus Villemoes To: Kees Cook , Andrew Morton Cc: linux-kernel@vger.kernel.org, Rasmus Villemoes , linux-nfs@vger.kernel.org, Trond Myklebust , linux-hwmon@vger.kernel.org, Miguel Ojeda , "Steven Rostedt (VMware)" , Jean Delvare , Guenter Roeck Subject: [RFC PATCH 0/7] runtime format string checking Date: Sat, 27 Oct 2018 01:24:02 +0200 Message-Id: <20181026232409.16100-1-linux@rasmusvillemoes.dk> X-Mailer: git-send-email 2.19.1.6.gbde171bbf5 In-Reply-To: <20171108223020.24487-1-linux@rasmusvillemoes.dk> References: <20171108223020.24487-1-linux@rasmusvillemoes.dk> MIME-Version: 1.0 Sender: linux-hwmon-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-hwmon@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP This is a resurrection of something I sent out about a year ago. In the relatively few places where we use a non-literal as format string, we can annotate the source with a fmtcheck() call that will (a) at build time, allow the compiler to check the variadic arguments against the template, and (b) at runtime, check that the format specifiers present in the actual format string match those in the template (and if not, WARN and use the template to ensure runtime type safety). Finding places to annotate is just make -j8 KCFLAGS='-Wformat-nonliteral' So far, in about half the places I looked, one might as well get completely rid of the non-literal format string. Patches 5,6,7 are some examples of where one might add fmtcheck() calls. I don't think we can get to a state where we can unconditionally add -Wformat-nonliteral to the build, but I think there's a lot of low-hanging fruit. This is on top of Miguel's compiler attributes series [1], which I hope will land in mainline soon. [1] https://github.com/ojeda/linux.git tags/compiler-attributes-for-linus-4.20-rc1 Rasmus Villemoes (7): compiler_attributes.h: add __attribute__((format_arg)) shorthand lib/vsprintf.c: add fmtcheck utility kernel.h: implement fmtmatch() wrapper around fmtcheck() lib/test_printf.c: add a few fmtcheck() test cases kernel/kthread.c: do runtime check of format string in kthread_create_on_cpu() nfs: use fmtcheck() in root_nfs_data drivers: hwmon: add runtime format string checking drivers/hwmon/hwmon.c | 3 +- fs/nfs/nfsroot.c | 2 +- include/linux/compiler_attributes.h | 13 ++++++ include/linux/kernel.h | 25 +++++++++++ kernel/kthread.c | 4 +- lib/Kconfig.debug | 9 ++++ lib/test_printf.c | 43 +++++++++++++++++++ lib/vsprintf.c | 65 +++++++++++++++++++++++++++++ 8 files changed, 160 insertions(+), 4 deletions(-)